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sy The 11 September Hijacker Cell Model 
(U) EXECUTIVE SUMMARY 
(U) Key Findings 


“YSNE) The 11 September hijackers successfully eluded the notice of US law enforcement and 
intelligence as they plotted to commandeer and use four airliners as weapons, but details of their 
lives and activities can be used to detect cells that may follow the 11 September hijackers’ model. 
It should be noted, however, that the 1993 attack on the World Trade Center and the Millennium 
bombing plot—the previous two major international terrorist operations on US soil—used tactics 
that are different in key respects from the 11 September model, suggesting that future sleeper cells 
will use a variety of measures to conceal their activities, 


The 11 September hijackers were all Middle Eastern men between 20 and 33 years of age 
who wore'a western style of dress and grooming. 


The hijackers entered the US legally and used either their true names or variations of their 
true names. Thirteen of the 19 hijackers traveled to the US in groups of two or three—four 
or the remaining six were the pilots. 
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Once in the country, the hijackers obtained typical US identification—driver licenses, state 
identification cards, and commercially available documents—likely in order to avoid further 
use of their passports. 


The hijackers changed residences frequently. 
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The hijackers’ enrollment at US flight schools was not in itself necessarily uncommon, but 
their focus during simulation training on leaming only the skills that would benefit their mission 
distinguished them from typical students. 


The hijackers opened bank accounts—often in pairs—with money either they brought legally 
into the US or wired from overseas. 


The hijackers largely avoided associating with radical Islamic groups in the US, likely in an. 
effort ta reduce the chances of detection by law enforcement. 


The hijackers’ communications techniques—face-to-face meetings, prepaid phone cards, payphones, 
cell phones, the Internet, and possibly commercially available mailboxes—made it difficult to 
trace their operational communications. 
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§& The 11 September Hijacker Cell Model Ol 


(S//NF) Al-Qa’ida leaders and key 11 September plotters such as Usama Bin Ladin, Khalid 
Shaykh Muhammad (KSM), and Ayman al-Zawahiri probably have derived lessons from the 
activities and experiences of the 11 September hijackers and may be relying on them to plan 
future attacks against the US. o [ Gg } 
« The 1! September plot was at least two years in the makin ‘An al- 
Qa’ida operative calling himself “Ubaydah” claimed in a videotaped interview in June 2002 
that al-Qa'ida sent a reconnaissance team to the US two years before the 11 September operation. 
We have no information to confirm that this reconnaissance operation occurred or that it can 
be tied to the 11 September attacks, but it is consistent with al-Qa’ida tradecraft that calls for 
lang and detailed planning for major operations. 
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Al-Qa’ida has lost its camps in Afghanistan where the plot was largely honed and 
the hijackers were trained, but between 10,000-20,000 potential terrorists trained in 
the camps and al-Qaida’s networks in countries such as Pakistan, Saudi Arabia, and 
Indonesia leave it with an ample pool of potential recruits for future attacks. 


(U) Snapshot of the Hijackers 


(LES) Al-Qa’ida’s criteria in choosing the 11 September hijackers is unknown, but one of the 
most important factors probably was their ability to not arouse suspicion from US or foreign 
intelligence and law enforcement services. 


* The hijackers used Western-style clothing and grooming once in the US. 


» The hijackers were all Middle Eastern men between 20 and 33 years of age. Many of them 
spent time in Afghanistan in either late 1999 or 2000, according to a variety of reporting. 


* Personal connections and family ties among the hijackers also may have been important; 
among the 19 were two sets of brothers—Waled and Wa’il al-Shehri and Nawaf and Salim al- 
Hazmi—and other sub-groupings in which individuals appear to have known each other for 
years before the plot. 


(U) How They Entered the US 


(LES). The hijackers entered the US legally on valid visas—15 on BI tourist visas, three on B2 
business visas, and one on a F1 student visa—using their true names. 


* Thirteen of the 19 hijackers traveled to the US in groups of two or three—the four pilots, 
Mohamed Atta, Marwan al-Shehhi, Hani Hanjour, and Ziad Jarrah are notable exceptions. 
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* The hijackers arrived in the US on eight different airlines: United, Delta, Virgin Atlantic, 
Swiss Air, Sabena, Ceskoslovski Air, Condor, and Saudi Airlines. Their flights departed from 
Brussels, Frankfort, London, Bangkok, Zurich, Riyadh, Paris, and Prague, and they arrived in 
Newark, Atlanta, San Diego, Orlando, Miami, Washington-Dulles, New York-JFK, and Los 


Angeles. 


° 


- The four pilots acquired their travel documents—passports from Saudi Arabia, United Arab 
Emirate (UAE), and Egypt, and visas issued in Jeddah, Saudi Arabia; Dubai, UAE; and 
Berlin, Germany—between one and five months before entering the US. The other hijackers 
acquired their documents—Saudi and UAE passports with visas issued mostly in Jeddah and 
Riyadh—from several months to more than a year before entering the US 


Most of the hijackers reported their previous passports as lost or stolen and received new 
ones that revealed no travel to Afghanistan—a potential “red flag” that might have invited 


scrutiny even prior to 11 September. 
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(U) Where They Lived and What They Drove 


(LES) The hijackers’ choices for living arrangements and cars were nondescript and likely would 
not have in themselves raised suspicion. 


¢ The hijackers usually lived in small groups of two to five and routinely moved between cheap 
motels and apartments. The pilots maintained relatively stable residence during their flight 
training, obtaining apartments for approximately six months. 


» They owned four older non-descript vehicles: Nawaf al-Hazmi’s 1988 Toyota Corolla, 
Jarrah’s 1990 Mitsubishi Eclipse, Waleed al-Shehri’s 1993 Dodge Colt and Atta’s 1989 
Pontiac Gran Prix. The hijackers also rented a variety of vehicles 27 times from several companies, 
including Enterprise, Budget, and Alamo. 


(U) Identification Used 


(LES) Many of the hijackers obtained identification cards or driver licenses to use instead of 
their passports, which would have called attention to them as foreigners. 


+ Eight hijackers obtained driver licenses from Arizona, California, and Florida, 16 obtained 
state identification cards from Florida and Virginia, and seven obtained commercially available 


ID cards. None had social security numbers, 


* At least two hijackers requested duplicate Florida driver licenses, and both Atta and al-Shehhi 
requested replacement pilot licenses, leaving open the possibility that al-Qa'ida forgers 
received the originals or duplicates and can try to reproduce these items, 
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(LES) Mohamed Attain Germany: His Conduct Before Coming to the US 


(LES) As an expatriate in Europe, Atta behaved much Sike the typical budding jihadist. I¢ was 
only after he apparently was tapped for his mission—perhaps spotted and selected because of 


REQ. 


this behavior—and returned from Afghanistan that he began observing strict operational security 
practices. 


* Prior to early February 2000, Atta and his associates in Hamburg—including 11 September 
pilots Marwan al-Shehhi and Ziad Jarrah—were known to. wear beards and Arab-style dress, 
attended a mosque known for extremists views, and openly associated with radical figures— 
all acts that contradict recommendations in al-Qa’ida training manuals not to behave in ways 
that would attract law enforcement attention, 


After defending his thesis in October 1999, Atta left for Afghanistan and Pakistan in late 
November and retumed to Hamburg in late February 2000, where he no longer appeared to be 
outwardly radical, according to law enforcement and intelligence reporting. He did not wear 
a beard or Arab-style dress and generally blended into the Western world. Shortly thereafter, 
Atta applied for a new passport—apparently both to disguise his travel to Afghanistan and 
to acquire a new photograph—made inquires to US flight schools, received a US visa, and 
spread word to family and friends that he was leaving Germany to continue his. education. 


(U) Flight Schools 


(LES) The hijackers enrollment at multiple US flight schools was not in itself uncommon, but 
their focus on learning only the skills that would benefit their mission—such as Atta and al- 
Shehhi requesting advanced jet flight training that focused on approaches and turns but not on 
take-offs and landings—made them stand-out. 


* Between June 2000 and September 2001, Atta, al-Shehhi, and Jarrah took flying classes, 
underwent flight simulator training, and flew test flights in at least eight facilities in Florida 
and Georgia. Atta and al-Shehhi also visited the Airman Flight Schoo! in Oklahoma. 


* Hanjour attended three flight schools in Arizona and California between 1996 and 1999. 
After returning to the US in December 2000, he took jet simulator lessons in Arizona and 
rented planes from at least five other facilities in Arizona, New Jersey, and Maryland. 


* Two other hijackers briefly took introductory flying lessons in San Diego in spring of 2000, 
but neither sought further flight training. 
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(U) Banking in the US 


(LES) The hijackers financed their operation with money electronically transferred from overseas 
as well as with cash and traveler checks they carried—and declared—when they entered the US. 
They opened US bank accounts and used them legally, but they favored an unusual practice of 
sharing accounts between unrelated members. None of the hijackers worked to supplement this 


funding. 


* The hijackers, often in pairs, used 24 bank accounts from branch banks belonging to Sun 
Trust, Hudson United, First Union, Bank ef America, and Dime Savings. 


* As the operation drew near, the hijackers closeil the majority of their bank accounts and wired 
most of the remaining money overseas through Western Union stations at bus terminals and 
grocery stores. 


(U) How They Communicated 


(LES) The hijackers favored communications techniques designed to make operational discussions 
diffieult to. trace. 


* They used pre-paid calling cards combined with payphones to make operational telephone 
calls to conspirators in the US as well as the Middle East and Germany, according to law 
enforcement information. They used cell phones to receive operational calls. 


* They apparently reserved their most sensitive planning discussions for face-to-face meetings, 
which likely were held three times in 2001; Germany in January, Spain in July, and Las Vegas 
in mid-August, 


« Atleast nine hijackers used post office mailboxes from such places as Mail Boxes Etc and 
Mail Depot, possibly to receive regular mail and to help establish residence. 


(U) Businesses They Frequented 


(LES) Besides rental car businesses and commercially available past office boxes, the hijackers 
also frequented several other businesses. 


* Many of the hijackers worked out at gyms——possibly to help prepare them for subduing passengers 
in taking over the airliners. 


* They used Kinkos for photocopying unknown materials and for cornputer rentals. 


* Marwan al-Shehhi also visited several bars during his stay in the US and along with Hamza 
al-Gamdi twice in July 2001 purchased a large amount of pornography—$250, and $183 
worth—from a Video Outlet store in Florida. 
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(U) Rituals 


(LES) While the hijackers made a special effort to blend in and conceal their jihadist zeal, this 
mask cracked in the closing days of their mission. 


* Amiaid at the Days Inn in Boston where the Flight 175 hijackers stayed the night before the 
attack reported finding a large amount of body hair in the room, all of the rooms’ lotion used— 
possibly to aid the shaving—and that they had only slept on top of their beds. 


* Copies of the same letter were recovered from the hijackers belongings that detailed steps and 
prayers that were-to be followed before the attacks. 
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(LES) Annex A: Ramzi Yousef’s and the 11 September Hijackers’ Operational Tradecraft 


(LES) There are some similarities between the 1993 World Trade Center (WTC) bombers led by 
Ramzi Yousef and the 11 September hijackers, but there also are key differences that make it difficult 
to establish a single pattern that sleeper cells in the US likely would follow. 


(LES) Key operational characteristics common to the 1993 and 2001 plotters include: 


_ * Some of the conspirators from both plots arrived in the US at least six months prior to the 
'  attacks—in some cases, more than a year—and members focused their time and energy in 
preparing for the attacks. ' 
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* Some members of each plot used shared bank accounts. 


* The key leaders of both plots—Yousef and the 11 September pilots—shared a variety of personal 
characteristics. They had broad exposure to the West—Yousef and three of the four pilots 
studied in Western Europe and had technical backgrounds—spoke workable English, were in 
their 20s or early 30s, and hailed from affluent families, 


(LES) Key operational differences include: 


* Yousef and co-conspirator Mohammed Ajaj traveled together from Pakistan and used false 
names and documents to enter to the US, while all 19 hijackers used their true names, legitimate 
passports, and secured visas to enter the country. 


Yousef used at least four passports and three different names to enter, operate, and exit the 
US, while the hijackers acquired legitimate forms of identification, such as driver’s licenses 
and state identification cards in their true name. 


Yousef relied on a local network of childhood friends and individuals introduced to him by 
others after his arrival in the US to carry out his attack. Most had no significant training and 
indoctrination, and one conspirator was brought into the plot. two weeks before the attack. 
Conversely, the hijackers relied mainly on experienced, well-trained manpower from abroad 
and did not bring unknown individuals into their plot after arriving in the US. 


The 1993 conspirators frequently made overseas phone calls from their residences, while 

the hijackers relied on prepaid cell phones, calling cards, and Internet cafes to communicate 
abroad. Yousef had a personal computer, but the hijackers are not known. to have owned laptop 
or desktop computers or any electronic data storage media. 
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(LES) Annex B: Ahmed Ressam and the 11 September Hijackers’ Tactics in the US: More 
Contrasts in Tradecraft 


(LES) There are few similarities between the Millennium bomber Ahmed Ressam and his plot to 
attack Los Angeles airport and the 11 September hijackers. 


Ressam’s identification documents—including passports, visas, driver licenses, social secunty 
numbers, and credit cards—-were all fraudulently obtained in contrast to the 11 September 
hijackers exclusive use of legitimate documentation. 
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Ressam applied for and was granted political asylum in Canada in 1994, inviting increased 
scrutiny by Canadian immigration authorities. The 11 September plotters sought no special 
immigration status. 


Although Ressam had lived in Canada since 1994, his English language abilities were poor, 
probably a result of living in a predominantly Algerian community. The 11 September pilots 
all spoke workable English. 


In contrast to the 11 September hijackers, neither Ressam nor his associate, Abdelmajid 
Dahoumane, conducted surveillance or route rehearsals to the US, other than with a map. 


In his debriefings, Ressam has indicated that his cell was instructed to engage in criminal 
behavior such as credit card fraud and petty theft, to finance their terrorist-related activities, 
Ressam was arrested for theft four times in only a few years. The 1] September hijackers 
used legitimate US bank accounts and either legally brought money to the US or had it electronically 
sent from the Middle East to their accounts. 


Like the 11 September hijackers, Ressam practiced operational security in communicating 
with his associates, although not as well. Ressam used multiple pre-paid calling cards and 
several different pay phones, but used a cellular phone to leave messages at the local mosque 
for associates to meet him there, 
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(U) Annex C: List of Hijackers and Planes 


American Airlines Flight 1 
Departed Boston—Crashed into the north tower of the World Trade Center 
76 passengers and 11 crew 


Mohamed Atta 

Satam al-Sugami 

Waled al-Shehri 

Wa’il al-Shehri 

Abdulaziz al-Omari 

United Airlines Flight 175 

Departed Boston—Crashed into the south tower of the World Trade Center 
31 passengers and nine crew 


Marwan al-Shehhi 
Fayez Banihammad 
Ahmed al-Ghamdi 
Hamza al-Gamdi 
Mohand al-Shehri 


American Airlines Flight 77 
Departed Washington Dulles—Crashed into. the Pentagon 
53. passengers and six crew 


Hani Hanjour 
Khalid al-Mihdhar 
Majed Moged 
Nawaf al-Hazmi 
Salem al-Hazmi 


United Airlines Flight 93 
Departed Newark—Crashed near Stony Creek Township, Pennsylvania 
33 passengers and seven crew 


Ziad Jarrah 

Saeed al-Ghamdi 
Ahmed al-Haznawi 
Ahmed al-Nami 


